Framework · Healthcare AI
State disclosure and clinician-review duties, from traffic.
Texas SB 1188 has required practitioner review and patient disclosure for diagnostic AI since 1 September 2025 and HB 149 has required disclosure of AI interaction since 1 January 2026; California AB 3030 has required generative-AI disclaimers on patient communications since 1 January 2025; Colorado HB 26-1139 takes effect on 1 January 2027; and the Joint Commission and CHAI published voluntary responsible-use guidance in September 2025. Meilynx evidences the LLM and agent slice: the disclosure baseline, clinician review, PHI egress, and a tamper-evident record. Disclosure, review, and governance are evidenced, never performed.
Disclose, review, retain, govern.
Four statutes and one voluntary framework converge on the same four duties.
- Disclose to the patient that they are interacting with, or receiving communications generated by, an AI system (TX HB 149 §552.001; CA AB 3030, H&S §1339.75).
- Review: a practitioner reviews AI-generated diagnostic records (TX SB 1188); a licensed provider's review exempts a communication from the California disclaimer; a qualified clinician reviews AI-involved denials from 2027 (CO HB 26-1139).
- Retain and locate: AI-assisted records meet medical-records standards and Texas EHRs stay in the United States (TX SB 1188).
- Govern: policies, privacy, data security, quality monitoring, safety-event reporting, bias assessment, and education (Joint Commission / CHAI RUAIH elements 1–7, voluntary).
Runtime expectations, to runtime evidence.
A specific Meilynx control for each expectation the proxy can substantiate, and the artifact it produces. Everything else is attested in the package, and the package says which is which.
State laws and Joint Commission / CHAI guidance → Meilynx controls (LLM / agent slice)
| Requirement | How Meilynx maps | Examination artifact |
|---|---|---|
Evidence the patient AI disclosure TX HB 149 · §552.001 · CA AB 3030 · H&S §1339.75 | The approved system-prompt baseline is where the disclosure language lives; prompt-drift detection evidences that it was not changed without approval. Whether the baseline carries the text and how the disclosure reaches the patient are attested. | Disclosure baseline and drift findings |
Show a practitioner reviewed the output TX SB 1188 · CA AB 3030 · CO HB 26-1139 (2027) | Approval gates and their review record are supporting evidence that a practitioner stood between AI output and its effect. The review is a human act, and this control never auto-verifies. | Approval-grant lifecycle and clinician-review attestation |
Know what PHI reached which vendor RUAIH E2 · TX SB 1188 (EMR location) | PHI and direct-identifier detection with in-flight redaction evidences what patient data actually reaches each AI vendor. Vendor data location, contracts, and diligence are attested. | PHI egress findings and vendor inventory |
Keep an AI record that meets records standards TX SB 1188 · RUAIH E4 | Each AI request and response is sealed into a hash-chained record with write-once retention, supporting reconstruction of what the assistant produced and who reviewed it. | Hash-chained AI record with retention |
Evidence the governance program RUAIH E1 · E4 · E5 · E7 · NIST AI RMF Govern · CO HB 26-1139 (2027) | The governance charter, quality monitoring, safety-event pathway, utilization-review safeguards, and workforce education are your program, attested in the package; the governance-configuration integrity check evidences that the adopted policy is the one enforced. | Governance, quality, and readiness attestations |
Evidence the patient AI disclosure
TX HB 149 · §552.001 · CA AB 3030 · H&S §1339.75
Maps to · The approved system-prompt baseline is where the disclosure language lives; prompt-drift detection evidences that it was not changed without approval. Whether the baseline carries the text and how the disclosure reaches the patient are attested.
Examination artifact · Disclosure baseline and drift findings
Show a practitioner reviewed the output
TX SB 1188 · CA AB 3030 · CO HB 26-1139 (2027)
Maps to · Approval gates and their review record are supporting evidence that a practitioner stood between AI output and its effect. The review is a human act, and this control never auto-verifies.
Examination artifact · Approval-grant lifecycle and clinician-review attestation
Know what PHI reached which vendor
RUAIH E2 · TX SB 1188 (EMR location)
Maps to · PHI and direct-identifier detection with in-flight redaction evidences what patient data actually reaches each AI vendor. Vendor data location, contracts, and diligence are attested.
Examination artifact · PHI egress findings and vendor inventory
Keep an AI record that meets records standards
TX SB 1188 · RUAIH E4
Maps to · Each AI request and response is sealed into a hash-chained record with write-once retention, supporting reconstruction of what the assistant produced and who reviewed it.
Examination artifact · Hash-chained AI record with retention
Evidence the governance program
RUAIH E1 · E4 · E5 · E7 · NIST AI RMF Govern · CO HB 26-1139 (2027)
Maps to · The governance charter, quality monitoring, safety-event pathway, utilization-review safeguards, and workforce education are your program, attested in the package; the governance-configuration integrity check evidences that the adopted policy is the one enforced.
Examination artifact · Governance, quality, and readiness attestations
What you hand a state regulator or a Joint Commission surveyor.
A governance package with a fifteen-row crosswalk over the Texas, California, and Colorado clauses and the seven Joint Commission / CHAI elements: each mapped to the section that answers it and the evidence scope it carries.
In the package
- AI tool inventory for patient care, from traffic.
- Disclosure evidence: baseline, drift rule state, attested text and channels.
- Clinician-review record and PHI egress evidence with the observed vendor list.
- Governance, quality-monitoring, and utilization-review readiness attestations.
- Obligation timeline: Texas and California in effect; Colorado HB 26-1139 and SB 26-189 as readiness for 2027; the guidance as voluntary.
Healthcare AI and the proxy.
Does the preset cover the Colorado AI Act?
Colorado SB 26-189, the automated decision-making statute, and HB 26-1139, the health-care AI bill signed on 2 June 2026, both take effect on 1 January 2027. The preset covers the utilization-review safeguards and the disclosure duty as readiness, and says so. The employment-specific duties belong to the HR / Employment AI preset.
Is the Joint Commission guidance a requirement?
No. The Responsible Use of AI in Healthcare guidance, published with the Coalition for Health AI in September 2025, is voluntary and does not affect accreditation. The preset uses its seven elements as the governance structure it evidences.
Does Meilynx verify that the disclosure was delivered?
It evidences that the approved configuration carrying the disclosure text did not change without approval. Whether the text is in the baseline and how it reaches the patient are attested on the disclosure control; a rule that checks the text itself is a future capability, not a claim.
Build the evidence.
See exactly what an examiner receives
Download a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.